@openclaw/zalo 2026.5.2 → 2026.5.3-beta.2

package/dist/monitor.webhook-DqnuvgjV.js

@@ -0,0 +1,175 @@
+import { $ as withResolvedWebhookRequestPipeline, B as resolveClientIp, F as readJsonWebhookBodyOrReject, R as registerWebhookTarget, i as WEBHOOK_RATE_LIMIT_DEFAULTS, q as resolveWebhookTargetWithAuthOrRejectSync, r as WEBHOOK_ANOMALY_COUNTER_DEFAULTS, s as applyBasicWebhookRequestGuards, v as createFixedWindowRateLimiter, y as createWebhookAnomalyTracker, z as registerWebhookTargetWithPluginRoute } from "./runtime-api-MOTmRW4F.js";
+import { createClaimableDedupe } from "openclaw/plugin-sdk/persistent-dedupe";
+import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
+//#region extensions/zalo/src/monitor.webhook.ts
+const ZALO_WEBHOOK_REPLAY_WINDOW_MS = 5 * 6e4;
+const webhookTargets = /* @__PURE__ */ new Map();
+const webhookRateLimiter = createFixedWindowRateLimiter({
+	windowMs: WEBHOOK_RATE_LIMIT_DEFAULTS.windowMs,
+	maxRequests: WEBHOOK_RATE_LIMIT_DEFAULTS.maxRequests,
+	maxTrackedKeys: WEBHOOK_RATE_LIMIT_DEFAULTS.maxTrackedKeys
+});
+const recentWebhookEvents = createClaimableDedupe({
+	ttlMs: ZALO_WEBHOOK_REPLAY_WINDOW_MS,
+	memoryMaxSize: 5e3
+});
+const webhookAnomalyTracker = createWebhookAnomalyTracker({
+	maxTrackedKeys: WEBHOOK_ANOMALY_COUNTER_DEFAULTS.maxTrackedKeys,
+	ttlMs: WEBHOOK_ANOMALY_COUNTER_DEFAULTS.ttlMs,
+	logEvery: WEBHOOK_ANOMALY_COUNTER_DEFAULTS.logEvery
+});
+function clearZaloWebhookSecurityStateForTest() {
+	webhookRateLimiter.clear();
+	recentWebhookEvents.clearMemory();
+	webhookAnomalyTracker.clear();
+}
+function getZaloWebhookRateLimitStateSizeForTest() {
+	return webhookRateLimiter.size();
+}
+function getZaloWebhookStatusCounterSizeForTest() {
+	return webhookAnomalyTracker.size();
+}
+function timingSafeEquals(left, right) {
+	return safeEqualSecret(left, right);
+}
+function buildReplayEventCacheKey(target, update) {
+	const messageId = update.message?.message_id;
+	if (!messageId) return null;
+	const chatId = update.message?.chat?.id ?? "";
+	const senderId = update.message?.from?.id ?? "";
+	return JSON.stringify([
+		target.path,
+		target.account.accountId,
+		update.event_name,
+		chatId,
+		senderId,
+		messageId
+	]);
+}
+var ZaloRetryableWebhookError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "ZaloRetryableWebhookError";
+	}
+};
+async function processZaloReplayGuardedUpdate(params) {
+	const replayEventKey = buildReplayEventCacheKey(params.target, params.update);
+	if (replayEventKey) {
+		if ((await recentWebhookEvents.claim(replayEventKey, { now: params.nowMs })).kind !== "claimed") return "duplicate";
+	}
+	params.target.statusSink?.({ lastInboundAt: Date.now() });
+	try {
+		await params.processUpdate({
+			update: params.update,
+			target: params.target
+		});
+		if (replayEventKey) await recentWebhookEvents.commit(replayEventKey);
+		return "processed";
+	} catch (error) {
+		if (replayEventKey) if (error instanceof ZaloRetryableWebhookError) recentWebhookEvents.release(replayEventKey, { error });
+		else await recentWebhookEvents.commit(replayEventKey);
+		throw error;
+	}
+}
+function recordWebhookStatus(runtime, path, statusCode) {
+	webhookAnomalyTracker.record({
+		key: `${path}:${statusCode}`,
+		statusCode,
+		log: runtime?.log,
+		message: (count) => `[zalo] webhook anomaly path=${path} status=${statusCode} count=${String(count)}`
+	});
+}
+function headerValue(value) {
+	return Array.isArray(value) ? value[0] : value;
+}
+function registerZaloWebhookTarget(target, opts) {
+	if (opts?.route) return registerWebhookTargetWithPluginRoute({
+		targetsByPath: webhookTargets,
+		target,
+		route: opts.route,
+		onLastPathTargetRemoved: opts.onLastPathTargetRemoved
+	}).unregister;
+	return registerWebhookTarget(webhookTargets, target, opts).unregister;
+}
+async function handleZaloWebhookRequest(req, res, processUpdate) {
+	return await withResolvedWebhookRequestPipeline({
+		req,
+		res,
+		targetsByPath: webhookTargets,
+		allowMethods: ["POST"],
+		handle: async ({ targets, path }) => {
+			const trustedProxies = targets[0]?.config.gateway?.trustedProxies;
+			const allowRealIpFallback = targets[0]?.config.gateway?.allowRealIpFallback === true;
+			const rateLimitKey = `${path}:${resolveClientIp({
+				remoteAddr: req.socket.remoteAddress,
+				forwardedFor: headerValue(req.headers["x-forwarded-for"]),
+				realIp: headerValue(req.headers["x-real-ip"]),
+				trustedProxies,
+				allowRealIpFallback
+			}) ?? req.socket.remoteAddress ?? "unknown"}`;
+			const nowMs = Date.now();
+			if (!applyBasicWebhookRequestGuards({
+				req,
+				res,
+				rateLimiter: webhookRateLimiter,
+				rateLimitKey,
+				nowMs
+			})) {
+				recordWebhookStatus(targets[0]?.runtime, path, res.statusCode);
+				return true;
+			}
+			const headerToken = String(req.headers["x-bot-api-secret-token"] ?? "");
+			const target = resolveWebhookTargetWithAuthOrRejectSync({
+				targets,
+				res,
+				isMatch: (entry) => timingSafeEquals(entry.secret, headerToken)
+			});
+			if (!target) {
+				recordWebhookStatus(targets[0]?.runtime, path, res.statusCode);
+				return true;
+			}
+			if (!applyBasicWebhookRequestGuards({
+				req,
+				res,
+				requireJsonContentType: true
+			})) {
+				recordWebhookStatus(target.runtime, path, res.statusCode);
+				return true;
+			}
+			const body = await readJsonWebhookBodyOrReject({
+				req,
+				res,
+				maxBytes: 1024 * 1024,
+				timeoutMs: 3e4,
+				emptyObjectOnEmpty: false,
+				invalidJsonMessage: "Bad Request"
+			});
+			if (!body.ok) {
+				recordWebhookStatus(target.runtime, path, res.statusCode);
+				return true;
+			}
+			const raw = body.value;
+			const record = raw && typeof raw === "object" ? raw : null;
+			const update = record && record.ok === true && record.result ? record.result : record ?? void 0;
+			if (!update?.event_name) {
+				res.statusCode = 400;
+				res.end("Bad Request");
+				recordWebhookStatus(target.runtime, path, res.statusCode);
+				return true;
+			}
+			processZaloReplayGuardedUpdate({
+				target,
+				update,
+				processUpdate,
+				nowMs
+			}).catch((err) => {
+				target.runtime.error?.(`[${target.account.accountId}] Zalo webhook failed: ${String(err)}`);
+			});
+			res.statusCode = 200;
+			res.end("ok");
+			return true;
+		}
+	});
+}
+//#endregion
+export { ZaloRetryableWebhookError, clearZaloWebhookSecurityStateForTest, getZaloWebhookRateLimitStateSizeForTest, getZaloWebhookStatusCounterSizeForTest, handleZaloWebhookRequest, processZaloReplayGuardedUpdate, registerZaloWebhookTarget };

package/dist/proxy-CY8VuC6H.js

@@ -0,0 +1,135 @@
+import { resolvePinnedHostnameWithPolicy } from "openclaw/plugin-sdk/ssrf-runtime";
+import { ProxyAgent, fetch as fetch$1 } from "undici";
+//#region extensions/zalo/src/api.ts
+/**
+* Zalo Bot API client
+* @see https://bot.zaloplatforms.com/docs
+*/
+const ZALO_API_BASE = "https://bot-api.zaloplatforms.com";
+const ZALO_MEDIA_SSRF_POLICY = {};
+var ZaloApiError = class extends Error {
+	constructor(message, errorCode, description) {
+		super(message);
+		this.errorCode = errorCode;
+		this.description = description;
+		this.name = "ZaloApiError";
+	}
+	/** True if this is a long-polling timeout (no updates available) */
+	get isPollingTimeout() {
+		return this.errorCode === 408;
+	}
+};
+/**
+* Call the Zalo Bot API
+*/
+async function callZaloApi(method, token, body, options) {
+	const url = `${ZALO_API_BASE}/bot${token}/${method}`;
+	const controller = new AbortController();
+	const timeoutId = options?.timeoutMs ? setTimeout(() => controller.abort(), options.timeoutMs) : void 0;
+	const fetcher = options?.fetch ?? fetch;
+	try {
+		const data = await (await fetcher(url, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: body ? JSON.stringify(body) : void 0,
+			signal: controller.signal
+		})).json();
+		if (!data.ok) throw new ZaloApiError(data.description ?? `Zalo API error: ${method}`, data.error_code, data.description);
+		return data;
+	} finally {
+		if (timeoutId) clearTimeout(timeoutId);
+	}
+}
+/**
+* Validate bot token and get bot info
+*/
+async function getMe(token, timeoutMs, fetcher) {
+	return callZaloApi("getMe", token, void 0, {
+		timeoutMs,
+		fetch: fetcher
+	});
+}
+/**
+* Send a text message
+*/
+async function sendMessage(token, params, fetcher) {
+	return callZaloApi("sendMessage", token, params, { fetch: fetcher });
+}
+/**
+* Send a photo message
+*/
+async function sendPhoto(token, params, fetcher) {
+	const photoUrl = params.photo.trim();
+	let parsedPhotoUrl;
+	try {
+		parsedPhotoUrl = new URL(photoUrl);
+	} catch {
+		throw new Error("Zalo photo URL must be an absolute HTTP or HTTPS URL");
+	}
+	if (parsedPhotoUrl.protocol !== "http:" && parsedPhotoUrl.protocol !== "https:") throw new Error("Zalo photo URL must use HTTP or HTTPS");
+	await resolvePinnedHostnameWithPolicy(parsedPhotoUrl.hostname, { policy: ZALO_MEDIA_SSRF_POLICY });
+	return callZaloApi("sendPhoto", token, {
+		...params,
+		photo: parsedPhotoUrl.href
+	}, { fetch: fetcher });
+}
+/**
+* Send a temporary chat action such as typing.
+*/
+async function sendChatAction(token, params, fetcher, timeoutMs) {
+	return callZaloApi("sendChatAction", token, params, {
+		timeoutMs,
+		fetch: fetcher
+	});
+}
+/**
+* Get updates using long polling (dev/testing only)
+* Note: Zalo returns a single update per call, not an array like Telegram
+*/
+async function getUpdates(token, params, fetcher) {
+	const pollTimeoutSec = params?.timeout ?? 30;
+	const timeoutMs = (pollTimeoutSec + 5) * 1e3;
+	return callZaloApi("getUpdates", token, { timeout: String(pollTimeoutSec) }, {
+		timeoutMs,
+		fetch: fetcher
+	});
+}
+/**
+* Set webhook URL for receiving updates
+*/
+async function setWebhook(token, params, fetcher) {
+	return callZaloApi("setWebhook", token, params, { fetch: fetcher });
+}
+/**
+* Delete webhook configuration
+*/
+async function deleteWebhook(token, fetcher, timeoutMs) {
+	return callZaloApi("deleteWebhook", token, void 0, {
+		timeoutMs,
+		fetch: fetcher
+	});
+}
+/**
+* Get current webhook info
+*/
+async function getWebhookInfo(token, fetcher) {
+	return callZaloApi("getWebhookInfo", token, void 0, { fetch: fetcher });
+}
+//#endregion
+//#region extensions/zalo/src/proxy.ts
+const proxyCache = /* @__PURE__ */ new Map();
+function resolveZaloProxyFetch(proxyUrl) {
+	const trimmed = proxyUrl?.trim();
+	if (!trimmed) return;
+	const cached = proxyCache.get(trimmed);
+	if (cached) return cached;
+	const agent = new ProxyAgent(trimmed);
+	const fetcher = (input, init) => fetch$1(input, {
+		...init,
+		dispatcher: agent
+	});
+	proxyCache.set(trimmed, fetcher);
+	return fetcher;
+}
+//#endregion
+export { getUpdates as a, sendMessage as c, getMe as i, sendPhoto as l, ZaloApiError as n, getWebhookInfo as o, deleteWebhook as r, sendChatAction as s, resolveZaloProxyFetch as t, setWebhook as u };

package/dist/runtime-BRFxnYQx.js

@@ -0,0 +1,8 @@
+import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
+//#region extensions/zalo/src/runtime.ts
+const { setRuntime: setZaloRuntime, getRuntime: getZaloRuntime } = createPluginRuntimeStore({
+	pluginId: "zalo",
+	errorMessage: "Zalo runtime not initialized"
+});
+//#endregion
+export { setZaloRuntime as n, getZaloRuntime as t };

package/dist/runtime-api-MOTmRW4F.js

@@ -0,0 +1,19 @@
+import "./runtime-BRFxnYQx.js";
+import { formatAllowFromLowercase as formatAllowFromLowercase$1, isNormalizedSenderAllowed as isNormalizedSenderAllowed$1 } from "openclaw/plugin-sdk/allow-from";
+import { PAIRING_APPROVED_MESSAGE, buildTokenChannelStatusSummary as buildTokenChannelStatusSummary$1 } from "openclaw/plugin-sdk/channel-status";
+import { deliverTextOrMediaReply as deliverTextOrMediaReply$1, isNumericTargetId as isNumericTargetId$1, sendPayloadWithChunkedTextAndMedia as sendPayloadWithChunkedTextAndMedia$1 } from "openclaw/plugin-sdk/reply-payload";
+import { buildBaseAccountStatusSnapshot } from "openclaw/plugin-sdk/status-helpers";
+import { chunkTextForOutbound as chunkTextForOutbound$1 } from "openclaw/plugin-sdk/text-chunking";
+import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, buildChannelConfigSchema, createDedupeCache, formatPairingApproveHint, jsonResult, normalizeAccountId as normalizeAccountId$1, readStringParam, resolveClientIp } from "openclaw/plugin-sdk/core";
+import { buildSecretInputSchema, hasConfiguredSecretInput as hasConfiguredSecretInput$1, normalizeResolvedSecretInputString, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";
+import { addWildcardAllowFrom as addWildcardAllowFrom$1, applyAccountNameToChannelSection, applySetupAccountConfigPatch, buildSingleChannelSecretPromptState as buildSingleChannelSecretPromptState$1, mergeAllowFromEntries as mergeAllowFromEntries$1, migrateBaseNameToDefaultAccount, promptSingleChannelSecretInput as promptSingleChannelSecretInput$1, runSingleChannelSecretStep as runSingleChannelSecretStep$1, setTopLevelChannelDmPolicyWithAllowFrom } from "openclaw/plugin-sdk/setup";
+import { evaluateSenderGroupAccess as evaluateSenderGroupAccess$1 } from "openclaw/plugin-sdk/group-access";
+import { resolveDefaultGroupPolicy as resolveDefaultGroupPolicy$1, resolveOpenProviderRuntimeGroupPolicy as resolveOpenProviderRuntimeGroupPolicy$1, warnMissingProviderGroupPolicyFallbackOnce as warnMissingProviderGroupPolicyFallbackOnce$1 } from "openclaw/plugin-sdk/runtime-group-policy";
+import { createChannelPairingController as createChannelPairingController$1 } from "openclaw/plugin-sdk/channel-pairing";
+import { createChannelReplyPipeline as createChannelReplyPipeline$1 } from "openclaw/plugin-sdk/channel-reply-pipeline";
+import { logTypingFailure as logTypingFailure$1 } from "openclaw/plugin-sdk/channel-feedback";
+import { resolveDirectDmAuthorizationOutcome as resolveDirectDmAuthorizationOutcome$1, resolveSenderCommandAuthorizationWithRuntime as resolveSenderCommandAuthorizationWithRuntime$1 } from "openclaw/plugin-sdk/command-auth";
+import { resolveInboundRouteEnvelopeBuilderWithRuntime as resolveInboundRouteEnvelopeBuilderWithRuntime$1 } from "openclaw/plugin-sdk/inbound-envelope";
+import { waitForAbortSignal } from "openclaw/plugin-sdk/runtime";
+import { WEBHOOK_ANOMALY_COUNTER_DEFAULTS, WEBHOOK_RATE_LIMIT_DEFAULTS, applyBasicWebhookRequestGuards, createFixedWindowRateLimiter, createWebhookAnomalyTracker, readJsonWebhookBodyOrReject, registerPluginHttpRoute as registerPluginHttpRoute$1, registerWebhookTarget, registerWebhookTargetWithPluginRoute, resolveWebhookPath as resolveWebhookPath$1, resolveWebhookTargetWithAuthOrRejectSync, withResolvedWebhookRequestPipeline } from "openclaw/plugin-sdk/webhook-ingress";
+export { withResolvedWebhookRequestPipeline as $, migrateBaseNameToDefaultAccount as A, resolveClientIp as B, formatPairingApproveHint as C, jsonResult as D, isNumericTargetId$1 as E, readJsonWebhookBodyOrReject as F, resolveSenderCommandAuthorizationWithRuntime$1 as G, resolveDirectDmAuthorizationOutcome$1 as H, readStringParam as I, runSingleChannelSecretStep$1 as J, resolveWebhookPath$1 as K, registerPluginHttpRoute$1 as L, normalizeResolvedSecretInputString as M, normalizeSecretInputString as N, logTypingFailure$1 as O, promptSingleChannelSecretInput$1 as P, warnMissingProviderGroupPolicyFallbackOnce$1 as Q, registerWebhookTarget as R, formatAllowFromLowercase$1 as S, isNormalizedSenderAllowed$1 as T, resolveInboundRouteEnvelopeBuilderWithRuntime$1 as U, resolveDefaultGroupPolicy$1 as V, resolveOpenProviderRuntimeGroupPolicy$1 as W, setTopLevelChannelDmPolicyWithAllowFrom as X, sendPayloadWithChunkedTextAndMedia$1 as Y, waitForAbortSignal as Z, createDedupeCache as _, addWildcardAllowFrom$1 as a, deliverTextOrMediaReply$1 as b, applySetupAccountConfigPatch as c, buildSecretInputSchema as d, buildSingleChannelSecretPromptState$1 as f, createChannelReplyPipeline$1 as g, createChannelPairingController$1 as h, WEBHOOK_RATE_LIMIT_DEFAULTS as i, normalizeAccountId$1 as j, mergeAllowFromEntries$1 as k, buildBaseAccountStatusSnapshot as l, chunkTextForOutbound$1 as m, PAIRING_APPROVED_MESSAGE as n, applyAccountNameToChannelSection as o, buildTokenChannelStatusSummary$1 as p, resolveWebhookTargetWithAuthOrRejectSync as q, WEBHOOK_ANOMALY_COUNTER_DEFAULTS as r, applyBasicWebhookRequestGuards as s, DEFAULT_ACCOUNT_ID$1 as t, buildChannelConfigSchema as u, createFixedWindowRateLimiter as v, hasConfiguredSecretInput$1 as w, evaluateSenderGroupAccess$1 as x, createWebhookAnomalyTracker as y, registerWebhookTargetWithPluginRoute as z };

package/dist/runtime-api.js

@@ -0,0 +1,3 @@
+import { $ as withResolvedWebhookRequestPipeline, A as migrateBaseNameToDefaultAccount, B as resolveClientIp, C as formatPairingApproveHint, D as jsonResult, E as isNumericTargetId, F as readJsonWebhookBodyOrReject, G as resolveSenderCommandAuthorizationWithRuntime, H as resolveDirectDmAuthorizationOutcome, I as readStringParam, J as runSingleChannelSecretStep, K as resolveWebhookPath, L as registerPluginHttpRoute, M as normalizeResolvedSecretInputString, N as normalizeSecretInputString, O as logTypingFailure, P as promptSingleChannelSecretInput, Q as warnMissingProviderGroupPolicyFallbackOnce, R as registerWebhookTarget, S as formatAllowFromLowercase, T as isNormalizedSenderAllowed, U as resolveInboundRouteEnvelopeBuilderWithRuntime, V as resolveDefaultGroupPolicy, W as resolveOpenProviderRuntimeGroupPolicy, X as setTopLevelChannelDmPolicyWithAllowFrom, Y as sendPayloadWithChunkedTextAndMedia, Z as waitForAbortSignal, _ as createDedupeCache, a as addWildcardAllowFrom, b as deliverTextOrMediaReply, c as applySetupAccountConfigPatch, d as buildSecretInputSchema, f as buildSingleChannelSecretPromptState, g as createChannelReplyPipeline, h as createChannelPairingController, i as WEBHOOK_RATE_LIMIT_DEFAULTS, j as normalizeAccountId, k as mergeAllowFromEntries, l as buildBaseAccountStatusSnapshot, m as chunkTextForOutbound, n as PAIRING_APPROVED_MESSAGE, o as applyAccountNameToChannelSection, p as buildTokenChannelStatusSummary, q as resolveWebhookTargetWithAuthOrRejectSync, r as WEBHOOK_ANOMALY_COUNTER_DEFAULTS, s as applyBasicWebhookRequestGuards, t as DEFAULT_ACCOUNT_ID, u as buildChannelConfigSchema, v as createFixedWindowRateLimiter, w as hasConfiguredSecretInput, x as evaluateSenderGroupAccess, y as createWebhookAnomalyTracker, z as registerWebhookTargetWithPluginRoute } from "./runtime-api-MOTmRW4F.js";
+import { n as setZaloRuntime } from "./runtime-BRFxnYQx.js";
+export { DEFAULT_ACCOUNT_ID, PAIRING_APPROVED_MESSAGE, WEBHOOK_ANOMALY_COUNTER_DEFAULTS, WEBHOOK_RATE_LIMIT_DEFAULTS, addWildcardAllowFrom, applyAccountNameToChannelSection, applyBasicWebhookRequestGuards, applySetupAccountConfigPatch, buildBaseAccountStatusSnapshot, buildChannelConfigSchema, buildSecretInputSchema, buildSingleChannelSecretPromptState, buildTokenChannelStatusSummary, chunkTextForOutbound, createChannelPairingController, createChannelReplyPipeline, createDedupeCache, createFixedWindowRateLimiter, createWebhookAnomalyTracker, deliverTextOrMediaReply, evaluateSenderGroupAccess, formatAllowFromLowercase, formatPairingApproveHint, hasConfiguredSecretInput, isNormalizedSenderAllowed, isNumericTargetId, jsonResult, logTypingFailure, mergeAllowFromEntries, migrateBaseNameToDefaultAccount, normalizeAccountId, normalizeResolvedSecretInputString, normalizeSecretInputString, promptSingleChannelSecretInput, readJsonWebhookBodyOrReject, readStringParam, registerPluginHttpRoute, registerWebhookTarget, registerWebhookTargetWithPluginRoute, resolveClientIp, resolveDefaultGroupPolicy, resolveDirectDmAuthorizationOutcome, resolveInboundRouteEnvelopeBuilderWithRuntime, resolveOpenProviderRuntimeGroupPolicy, resolveSenderCommandAuthorizationWithRuntime, resolveWebhookPath, resolveWebhookTargetWithAuthOrRejectSync, runSingleChannelSecretStep, sendPayloadWithChunkedTextAndMedia, setTopLevelChannelDmPolicyWithAllowFrom, setZaloRuntime, waitForAbortSignal, warnMissingProviderGroupPolicyFallbackOnce, withResolvedWebhookRequestPipeline };

package/dist/secret-contract-Dw93tGo2.js

@@ -0,0 +1,87 @@
+import { collectConditionalChannelFieldAssignments, getChannelSurface, hasOwnProperty } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
+//#region extensions/zalo/src/secret-contract.ts
+const secretTargetRegistryEntries = [
+	{
+		id: "channels.zalo.accounts.*.botToken",
+		targetType: "channels.zalo.accounts.*.botToken",
+		configFile: "openclaw.json",
+		pathPattern: "channels.zalo.accounts.*.botToken",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.zalo.accounts.*.webhookSecret",
+		targetType: "channels.zalo.accounts.*.webhookSecret",
+		configFile: "openclaw.json",
+		pathPattern: "channels.zalo.accounts.*.webhookSecret",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.zalo.botToken",
+		targetType: "channels.zalo.botToken",
+		configFile: "openclaw.json",
+		pathPattern: "channels.zalo.botToken",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.zalo.webhookSecret",
+		targetType: "channels.zalo.webhookSecret",
+		configFile: "openclaw.json",
+		pathPattern: "channels.zalo.webhookSecret",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	}
+];
+function collectRuntimeConfigAssignments(params) {
+	const resolved = getChannelSurface(params.config, "zalo");
+	if (!resolved) return;
+	const { channel: zalo, surface } = resolved;
+	collectConditionalChannelFieldAssignments({
+		channelKey: "zalo",
+		field: "botToken",
+		channel: zalo,
+		surface,
+		defaults: params.defaults,
+		context: params.context,
+		topLevelActiveWithoutAccounts: true,
+		topLevelInheritedAccountActive: ({ account, enabled }) => enabled && !hasOwnProperty(account, "botToken"),
+		accountActive: ({ enabled }) => enabled,
+		topInactiveReason: "no enabled Zalo surface inherits this top-level botToken.",
+		accountInactiveReason: "Zalo account is disabled."
+	});
+	const baseWebhookUrl = typeof zalo.webhookUrl === "string" ? zalo.webhookUrl.trim() : "";
+	const accountWebhookUrl = (account) => hasOwnProperty(account, "webhookUrl") ? typeof account.webhookUrl === "string" ? account.webhookUrl.trim() : "" : baseWebhookUrl;
+	collectConditionalChannelFieldAssignments({
+		channelKey: "zalo",
+		field: "webhookSecret",
+		channel: zalo,
+		surface,
+		defaults: params.defaults,
+		context: params.context,
+		topLevelActiveWithoutAccounts: baseWebhookUrl.length > 0,
+		topLevelInheritedAccountActive: ({ account, enabled }) => enabled && !hasOwnProperty(account, "webhookSecret") && accountWebhookUrl(account).length > 0,
+		accountActive: ({ account, enabled }) => enabled && accountWebhookUrl(account).length > 0,
+		topInactiveReason: "no enabled Zalo webhook surface inherits this top-level webhookSecret (webhook mode is not active).",
+		accountInactiveReason: "Zalo account is disabled or webhook mode is not active for this account."
+	});
+}
+const channelSecrets = {
+	secretTargetRegistryEntries,
+	collectRuntimeConfigAssignments
+};
+//#endregion
+export { collectRuntimeConfigAssignments as n, secretTargetRegistryEntries as r, channelSecrets as t };

package/dist/secret-contract-api.js

@@ -0,0 +1,2 @@
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-Dw93tGo2.js";
+export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };

package/dist/send-Gv3l5EGI.js

@@ -0,0 +1,101 @@
+import { a as resolveZaloAccount, o as resolveZaloToken } from "./accounts-9NLDDlZ8.js";
+import { c as sendMessage, l as sendPhoto, t as resolveZaloProxyFetch } from "./proxy-CY8VuC6H.js";
+import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+//#region extensions/zalo/src/send.ts
+function toZaloSendResult(response) {
+	if (response.ok && response.result) return {
+		ok: true,
+		messageId: response.result.message_id
+	};
+	return {
+		ok: false,
+		error: "Failed to send message"
+	};
+}
+async function runZaloSend(failureMessage, send) {
+	try {
+		const result = toZaloSendResult(await send());
+		return result.ok ? result : {
+			ok: false,
+			error: failureMessage
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: formatErrorMessage(err)
+		};
+	}
+}
+function resolveSendContext(options) {
+	if (options.cfg) {
+		const account = resolveZaloAccount({
+			cfg: options.cfg,
+			accountId: options.accountId
+		});
+		return {
+			token: options.token || account.token,
+			fetcher: resolveZaloProxyFetch(options.proxy ?? account.config.proxy)
+		};
+	}
+	const token = options.token ?? resolveZaloToken(void 0, options.accountId).token;
+	const proxy = options.proxy;
+	return {
+		token,
+		fetcher: resolveZaloProxyFetch(proxy)
+	};
+}
+function resolveValidatedSendContext(chatId, options) {
+	const { token, fetcher } = resolveSendContext(options);
+	if (!token) return {
+		ok: false,
+		error: "No Zalo bot token configured"
+	};
+	const trimmedChatId = chatId?.trim();
+	if (!trimmedChatId) return {
+		ok: false,
+		error: "No chat_id provided"
+	};
+	return {
+		ok: true,
+		chatId: trimmedChatId,
+		token,
+		fetcher
+	};
+}
+function resolveSendContextOrFailure(chatId, options) {
+	const context = resolveValidatedSendContext(chatId, options);
+	return context.ok ? { context } : { failure: {
+		ok: false,
+		error: context.error
+	} };
+}
+async function sendMessageZalo(chatId, text, options = {}) {
+	const resolved = resolveSendContextOrFailure(chatId, options);
+	if ("failure" in resolved) return resolved.failure;
+	const { context } = resolved;
+	if (options.mediaUrl) return sendPhotoZalo(context.chatId, options.mediaUrl, {
+		...options,
+		token: context.token,
+		caption: text || options.caption
+	});
+	return await runZaloSend("Failed to send message", () => sendMessage(context.token, {
+		chat_id: context.chatId,
+		text: text.slice(0, 2e3)
+	}, context.fetcher));
+}
+async function sendPhotoZalo(chatId, photoUrl, options = {}) {
+	const resolved = resolveSendContextOrFailure(chatId, options);
+	if ("failure" in resolved) return resolved.failure;
+	const { context } = resolved;
+	if (!photoUrl?.trim()) return {
+		ok: false,
+		error: "No photo URL provided"
+	};
+	return await runZaloSend("Failed to send photo", () => (async () => sendPhoto(context.token, {
+		chat_id: context.chatId,
+		photo: photoUrl.trim(),
+		caption: options.caption?.slice(0, 2e3)
+	}, context.fetcher))());
+}
+//#endregion
+export { sendMessageZalo as t };

package/dist/setup-api.js

@@ -0,0 +1,30 @@
+import { n as zaloDmPolicy, r as zaloSetupAdapter, t as createZaloSetupWizardProxy } from "./setup-core-DigRD3j1.js";
+import { r as resolveZaloRuntimeGroupPolicy, t as evaluateZaloGroupAccess } from "./group-access-DZR43lOR.js";
+import { loadBundledEntryExportSync } from "openclaw/plugin-sdk/channel-entry-contract";
+//#region extensions/zalo/setup-api.ts
+function createLazyObjectValue(load) {
+	return new Proxy({}, {
+		get(_target, property, receiver) {
+			return Reflect.get(load(), property, receiver);
+		},
+		has(_target, property) {
+			return property in load();
+		},
+		ownKeys() {
+			return Reflect.ownKeys(load());
+		},
+		getOwnPropertyDescriptor(_target, property) {
+			const descriptor = Object.getOwnPropertyDescriptor(load(), property);
+			return descriptor ? {
+				...descriptor,
+				configurable: true
+			} : void 0;
+		}
+	});
+}
+function loadSetupSurfaceModule() {
+	return loadBundledEntryExportSync(import.meta.url, { specifier: "./src/setup-surface.js" });
+}
+const zaloSetupWizard = createLazyObjectValue(() => loadSetupSurfaceModule().zaloSetupWizard);
+//#endregion
+export { createZaloSetupWizardProxy, evaluateZaloGroupAccess, resolveZaloRuntimeGroupPolicy, zaloDmPolicy, zaloSetupAdapter, zaloSetupWizard };